Privilege reference
Privilege reference
In the Coveo privilege system, each domain can be associated to one or more access level to form a privilege, which allows an API key or a group of users to perform certain operations in the Coveo Administration Console. See Manage privileges and Navigate the "Privileges" tab for more information.
However, although many domains offer a View and an Edit access level, the abilities represented by these access levels may differ from domain to domain. Some domains also offer different access level options such as Allowed or Push. So, to help you grant the appropriate privilege to groups of users or API keys, this page details what your grantee can do when granted each access level option for each domain. In the Coveo Administration Console, domains of privilege are grouped by service, and this page uses the same arrangement. Use the In this article menu on the right side of the page to browse the services and domains.
|
The operation of granting privileges isn’t to be taken lightly, as insufficient privileges can hinder task accomplishment, while inadequate or unnecessary privileges could lead to accidents or misuse. When allowed to delegate powers, you should have a good understanding of how the Coveo privilege system works and be well aware of the implications of each choice you make. In this regard, we recommend thoroughly reading the privilege documentation before granting privileges or editing a privilege set, and enforcing the principle of least privilege, i.e., granting just enough privileges for the grantee to perform their tasks (see Manage privileges and Principle of Least Privilege). |
In the tables below, the typical grantees associated to a privilege are mostly the built-in groups that are granted this access level by default. However, they could also include typical groups of users that should have the privilege granted to them (e.g., support agents). Members of the Administrators group are always granted the highest access level. Similarly, the Typical grantee column shows which API key presets are granted each access level.
Analytics service
Administrate domain
Access level | Grantee abilities | Typical grantees | ||
---|---|---|---|---|
Allowed |
|
|
Analytics Data domain
Access level | Grantee abilities | Typical grantees |
---|---|---|
View |
|
|
Push | Send analytics events to Coveo Usage Analytics (Coveo UA) |
|
Push and view |
|
|
Data Exports domain
|
The Data exports domain access levels are ineffective without the View access level on the Analytics data domain |
Access level | Grantee abilities | Typical grantees |
---|---|---|
View | View and download usage analytics data exports containing clicks, groups, keywords, searches, and custom events meeting the specified criteria for a specific date range | Monitoring API keys |
Edit |
|
|
Data Health domain
|
The Data Health domain access level is ineffective without the View access level on the Tableau Reports domain. |
Access level | Grantee abilities | Typical grantees |
---|---|---|
View |
Administrators |
Delete User Data domain
Access level | Grantee abilities | Typical grantees | ||
---|---|---|---|---|
Allowed |
Delete usage analytics user data
|
|
Dimensions domain
|
The Dimensions domain access levels are ineffective without the View access level on the Analytics data domain. |
Access level | Grantee abilities | Typical grantees |
---|---|---|
View |
|
|
Edit | Add, edit, or delete dimensions created by Coveo organization members |
|
Impersonate domain
Access level | Grantee abilities | Typical grantees |
---|---|---|
Allowed | Allow a custom process or bot to push usage analytics events with different identities |
|
Incoherent Events domain
Access level | Grantee abilities | Typical grantees |
---|---|---|
View |
|
Named Filters domain
|
The Named filters domain access levels are ineffective without the View access level on the Analytics data and Dimensions domains. |
Access level | Grantee abilities | Typical grantees |
---|---|---|
View | View named filters |
|
Edit | Add, edit, or delete named filters |
|
Permission Filters domain
|
The Permission filters domain access levels are ineffective without the View access level on the Analytics data and Dimensions domains. |
Access level | Grantee abilities | Typical grantees | ||
---|---|---|---|---|
View |
View permission filters restricting the usage analytics data that analysts can review in reports
|
|
||
Edit |
|
|
Reports domain
|
The Reports domain access levels are ineffective without the View access level on the Analytics data and Dimensions domains. |
Access level | Grantee abilities | Typical grantees | ||
---|---|---|---|---|
View |
View usage analytics reports (dashboards and explorers) |
|
||
Edit |
Add, edit, or delete usage analytics reports (dashboards and explorers)
|
|
Snowflake Management domain
|
The Edit access level is ineffective without the Allowed access level on the Administrate domain. |
Access level | Grantee abilities | Typical grantees |
---|---|---|
View |
|
|
Edit |
|
|
Tableau Reports domain
|
The Tableau Reports domain access level is ineffective without the View access level on the Analytics Data and the Reports domains. |
Access level | Grantee abilities | Typical grantees |
---|---|---|
View |
View advanced reports |
|
View All Reports domain
Access level | Grantee abilities | Typical grantees | ||
---|---|---|---|---|
Allowed |
View all reports, regardless of report accesses. Members that don’t have this access level can only review the reports they’re explicitly allowed to access.
|
|
Commerce service
Catalog domain
Access level | Grantee abilities | Typical grantees |
---|---|---|
View | View catalogs and catalog configuration | Monitoring API keys |
Edit | Add, edit, or delete catalogs |
|
Product Listing domain
Access level | Grantee abilities | Typical grantees |
---|---|---|
View | View product listings | Monitoring API keys |
Edit | Add, edit, or delete product listings |
|
Content service
Connectivity Diagnostic Logs domain
Access level | Grantee abilities | Typical grantees |
---|---|---|
View | Download update logs |
|
Crawling Module domain
Access level | Grantee abilities | Typical grantees | ||
---|---|---|---|---|
View |
|
|
||
Edit |
This access level allows a Crawling Module instance to report its status to Coveo. This status is then displayed on the Crawling Modules (platform-ca | platform-eu | platform-au) page. Granting this access level to groups of users doesn’t give them any additional capabilities. |
|
Crawling Module Log Request
Access level | Grantee abilities | Typical grantees | ||
---|---|---|---|---|
View |
Granting this privilege to groups of users or API keys doesn’t give them any additional capabilities. |
|||
Edit |
|
|
Extensions domain
Access level | Grantee abilities | Typical grantees | |
---|---|---|---|
View all | View the code and usage statistics of available extensions assigned to sources. This is especially useful when troubleshooting cases such as item indexing issues. | Monitoring API keys | |
Custom | View | View the code and usage statistics of the specified extensions. This is especially useful when troubleshooting cases such as item indexing issues. | |
Edit | Add code snippets to apply transformations to indexed items such as adding or modifying metadata. We recommend that you grant this privilege to developers only. | ||
Edit all | Add code snippets to apply transformations to indexed items such as adding or modifying metadata. We recommend that you grant this privilege to developers only. |
|
Fields domain
Logical Indexes domain
Access level | Grantee abilities | Typical grantees |
---|---|---|
View | When your organization has more than one index:
|
Monitoring API keys |
Edit | This access level doesn't give its grantee any additional capabilities. |
|
Security Identities domain
|
The Security identities domain access levels are ineffective without the View access level on the Security identity providers domain. |
Access level | Grantee abilities | Typical grantees |
---|---|---|
View |
|
Monitoring API keys |
Edit | Only required by certain API calls (e.g., enable all disabled entities in security cache). Granting this access level to groups of users doesn't give them any additional capabilities. |
|
Security Identity Providers domain
Access level | Grantee abilities | Typical grantees |
---|---|---|
View |
|
Monitoring API keys |
Edit |
|
Source Metadata domain
Access level | Grantee abilities | Typical grantees | ||
---|---|---|---|---|
View |
View a sample of the metadata discovered while indexing a source
|
|
Sources domain
|
Notes
|
Access level | Grantee abilities | Typical grantees | |
---|---|---|---|
View all |
|
Users |
|
Custom | View |
|
Monitoring API keys |
Edit |
|
||
Edit all |
|
|
Customer service
Case Assist Configuration domain
Access level | Grantee abilities | Typical grantees |
---|---|---|
View | View elements of the Case Assist (platform-ca | platform-eu | platform-au) page | Monitoring API keys |
Edit | Manage elements of the Case Assist (platform-ca | platform-eu | platform-au) page |
|
Use Case Assist domain
Access level | Grantee abilities | Typical grantees |
---|---|---|
Allowed | Leverage case assist configurations in support cases |
|
Insight Panel Configuration domain
Access level | Grantee abilities | Typical grantees |
---|---|---|
View | View elements of the Insight Panel (platform-ca | platform-eu | platform-au) page | Monitoring API keys |
Edit | Manage elements of the Insight Panel (platform-ca | platform-eu | platform-au) page |
|
Insight Panel Interface domain
Access level | Grantee abilities | Typical grantees |
---|---|---|
View | View an Insight Panel interface in a Customer Relationship Management (CRM) system | Monitoring API keys |
Edit | Create, update, or delete an Insight Panel interface |
|
Insight Panel Items domain
Access level | Grantee abilities | Typical grantees |
---|---|---|
View | View items that are relevant to a case in an Insight Panel interface |
|
Machine Learning service
Allow Content Preview domain
Access level | Grantee abilities | Typical grantees | ||
---|---|---|---|---|
Enable |
Inspect the resources available to create content-based Coveo Machine Learning models
|
|
Models domain
Access level | Grantee abilities | Typical grantees |
---|---|---|
View | View Coveo Machine Learning models | Monitoring API keys |
Edit | Add, edit, or delete machine learning models, and therefore optimize search results relevance and search experience in general |
|
User Profiles domain
Access level | Grantee abilities | Typical grantees |
---|---|---|
View | View the Coveo Machine Learning user profile made for each user or visitor ID | Monitoring API keys |
Edit | Edit the Coveo Machine Learning user profile made for each user or visitor ID |
|
Organization service
API Keys domain
|
Note
This domain is only available when configuring groups, as API keys can’t be granted the privilege to view or edit other API keys. |
Activities domain
Access level | Grantee abilities | Typical grantees | ||
---|---|---|---|---|
View |
|
|
||
Edit |
|
Critical Updates domain
Access level | Grantee abilities | Typical grantees | |
---|---|---|---|
View |
Access the list of available critical updates |
Monitoring API keys | |
Edit |
Enable/disable critical updates in the organization |
|
Groups domain
|
Leading practice
Grant the Edit or Edit all access level for the Groups domain only to a few people, ideally the authority in your company that manages access rights in corporate systems. |
Access level | Grantee abilities | Typical grantees | |
---|---|---|---|
View all |
|
|
|
Custom | View |
View groups, including their privileges |
|
Edit |
|
Relevance managers |
|
Edit all |
|
|
|
Note
For the above grantees, by default, members of the Relevance Managers built-in group can edit this group only. This allows them to invite other people in the Relevance Managers group, but not in other groups. |
|
The Edit all access level is especially potent since grantees can use it to add anyone, including themselves, to any organization group. This can lead to privilege escalation |
Link domain
See Privileges required to manage snapshots for details on the privileges you need to use the resource snapshot feature.
Access level | Grantee abilities | Typical grantees | |
---|---|---|---|
View |
|
Monitoring API keys |
|
Edit |
|
Notifications domain
Access level | Grantee abilities | Typical grantees | |
---|---|---|---|
View |
Monitoring API keys |
||
Edit |
|
On-Premises Administration domain
The privileges of this domain are required by the Coveo On-Premises Crawling Module API keys only. Granting these privileges to groups of users doesn’t give them any additional capabilities.
Access level | Grantee abilities | Typical grantees | ||
---|---|---|---|---|
View |
Monitoring API keys |
|||
Edit |
This access level, when granted to a Coveo On-Premises Crawling Module API key, allows the Crawling Module to communicate with Coveo. Granting it to users or groups doesn’t give them any additional capabilities. |
|
Organization domain
Access level | Grantee abilities | Typical grantees |
---|---|---|
View |
|
|
Edit |
|
Single Sign-On Identity Provider domain
Access level | Grantee abilities | Typical grantees | |
---|---|---|---|
View | View the organization's single sign-on configuration | Monitoring API keys | |
Edit | Configure single sign-on for the organization |
|
Snapshots domain
See Privileges required to manage snapshots for details on the privileges you need to use the resource snapshot feature.
Access level | Grantee abilities | Typical grantees | |
---|---|---|---|
View |
|
Monitoring API keys | |
Edit |
|
|
Temporary Access domain
Access level | Grantee abilities | Typical grantees | |
---|---|---|---|
View | View who at Coveo has asked for and been granted temporary access to your organization, as well as the privileges they were granted | Monitoring API keys | |
Edit | Revoke temporary access to your organization |
|
Vault Entry domain
See Privileges required to manage snapshots for details on the privileges you need to use the resource snapshot feature.
|
Note
To import sensitive information in your destination organization, you must have both of the following privileges:
|
Access level | Grantee abilities | Typical grantees | |
---|---|---|---|
View | Import sensitive information (in the origin organization) |
|
|
Edit |
|
|
Search service
Execute Queries domain
Access level | Grantee abilities | Typical grantees |
---|---|---|
Allowed | For organization members and API keys to send queries and get search results in search pages connected to their Coveo organization |
|
Expression Validation Result domain
Required to use an upcoming feature. Granting privileges on this domain doesn’t give the grantee any additional capabilities yet.
Impersonate domain
Access level | Grantee abilities | Typical grantees | ||
---|---|---|---|---|
Allowed |
Obtain a search token for a search interface that replicates a permission system to execute queries and send usage analytics events as a specific user. See Use search token authentication for more information.
|
|
Modify Authentication Provider domain
Access level | Grantee abilities | Typical grantees |
---|---|---|
Allowed | Manage authentication for sources that index permissions, such as when they're secured with SharePoint claims-based identities |
|
Query Logs domain
Access level | Grantee abilities | Typical grantees |
---|---|---|
View | In your consumption dashboard, download a list of the queries performed in a hub during a certain month |
|
Query Pipelines domain
Access level | Grantee abilities | Typical grantees | |
---|---|---|---|
View all | Monitoring API keys | ||
Custom | View |
|
|
Edit | |||
Edit all |
Optimize results relevance and search experience in general: |
|
Salesforce Index Configuration domain
Access level | Grantee abilities | Typical grantees |
---|---|---|
View |
Monitoring API keys |
|
Edit |
Link a Coveo organization to a Salesforce organization that uses a Salesforce index |
|
Search Pages domain
Access level | Grantee abilities | Typical grantees | |
---|---|---|---|
View all | Access all the search pages hosted by the Coveo organization |
|
|
Custom | View | None yet. Custom search page privileges will be available following an upcoming release. | |
Edit | None yet. Custom search page privileges will be available following an upcoming release. | ||
Edit all |
|
|
The Edit all access level is a sensitive privilege which is typically granted only to administrators. This privilege should remain limited to avoid being exploited by malicious users who could enter unwanted code and put search page users at risk. |
Search Usage Metrics domain
Access level | Grantee abilities | Typical grantees | |
---|---|---|---|
View | View the Consumption dashboard |
|
|
Edit | Edit the entitlement metric of a search hub in the Consumption dashboard |
|
View All Content domain
Access level | Grantee abilities | Typical grantees | ||
---|---|---|---|---|
Allowed |
|
Administrators |